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Status 

1 )^| Responsive to communication(s) filed on 29 January 2009 . 
2a )□ This action is FINAL. 2b)£3 This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^3 Claim(s) 3, 6-9, 11,14,1 7-20 and 22-30 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) |EI Claim(s) 3, 6-9, 11, 14, 17-20, and 22-30 is/are rejected. 

7) 0 Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) L~H The specification is objected to by the Examiner. 
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DETAILED ACTION 

1 . This action is in response to Applicant's request for continued examination. Claims 3, 8, 
14, and 19 are amended. Claims 4, 5, 15, and 16 are canceled. Claims 1,2, 10, 12, 13, and 21 
were previously canceled. Accordingly, claims 3, 6-9, 11, 14, 17-20, and 22-30 are presented for 
further examination. 

2. This action is a non-final rejection. 

Continued Examination Under 37 CFR 1.114 

3. A request for continued examination under 37 CFR 1.1 14, including the fee set forth in 
37 CFR 1 .17(e), was filed in this application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1.1 14, and the fee set forth in 37 CFR 1.17(e) 
has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 
37 CFR 1.1 14. Applicant's submission filed on 1/29/2009 has been entered. 

Response to Arguments 

4. Applicant's arguments with respect to claims 3, 6-9, 11, 14, 17-20, and 22-30 have been 
considered but are moot in view of the new ground(s) of rejection. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 



Application/Control Number: 09/788,566 
Art Unit: 2452 



Page 3 



(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

5. Claims 3, 6-9, 1 1, 14, 17-20 and 22-25 are rejected under 35 U.S.C § 103(a) as being 
unpatentable over Abraham et al, U.S Patent No. 5.983.270 ["Abraham"], in view of Nickles, 
U.S Patent No. 6.134.591, in further view of Bruins et al, U.S. Patent No. 6.308.148 ["Bruins"]. 

6. As to claim 3, Abraham discloses a system for monitoring packets transmitted on a 
channel connecting an application server and an end-user of said application server to each other, 
said system comprising: 

a certification server which certificates the end-user [column 5 «line 63 » to column 6 
«line 4»]; and 

a packet monitor device which, on receipt of a request from said certification server, 
monitors packets transmitted on said channel [column 1 «lines 13-17» | column 7 «lines 51-67»], 
wherein said certification server includes: 

a first memory which stores a user management table including ID numbers of 
end-users, a monitoring parameter designating a packet to be monitored, a threshold 
parameter designating a method of monitoring said packet [Figures 9D, 17, 25 A, 25B : 
notify rule, log rule | column 15 «lines 35-40»]; and 

a second device which transmits a request to said packet monitor device to start or 
finish monitoring said packet at a timing when said end-user logs-in or logs-out the 
terminal [column 9 «lines 1-1 0»]; 
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wherein said packet monitor device includes: 

a fourth memory which stores a first time at which a packet transmitted from one of 
said application server and said user arrives, when said packet monitor device receives a request 
from said second device to monitor said packet [Figure 20 | column 47 «lines 14-24»]; 

an analyzer which monitors a second time at which packets meeting said monitoring 
parameter arrive, and determines whether any rule has been satisfied during an interval between 
said first time and said second time [column 7 «lines 51-67» | column 9 «lines 51-65» | column 
47 «lines 14-24» | column 41 «line 53» to column 42 «line 42»]; and 

an annunciator which makes annunciation to said user when a certain rule is satisfied 
during said interval [Figure 26 | column 1 1 «lines 53-64» | column 13 «lines 62-67]; and 

wherein said packet monitor device is configured to monitor at least one of a data 
sequence of said packets, a service identifier of said packets [Figure 8 J | column 21 «lines 39-50» 
: protocol ID identifies the type of service - for example, email, web, or FTP], and a checksum 
of said packet; and 

wherein said threshold parameter is a predetermined number [Fig. 25b «item 1 77»] . 

Abraham does not expressly disclose (1) storing a password in the table or (2) wherein 
said rule is that whether a total number of continuously receiving packets meeting said 
monitoring parameter in said interval is over said predetermined number. However both features 
were well known in the art at the time of Applicant's invention as evidenced by Nickles and 
Bruins. 

As to the first limitation, Abraham does disclose storing user's information, including the 
user's ID and access level [column 16 «lines 6-9»]. Additionally, as is well known in the art, 
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Abraham also discloses the feature whereby a user logs on to his terminal using a password 
[column 5 «lines 63-67» | see also response to arguments above]. In a related field of invention, 
Nickles discloses a management database that stores usernames with their respective passwords 
for the same purpose as Abraham [Figure 7 «item 708a» | column 6 «lines 7-17»]. Therefore it 
would have been obvious to one of ordinary skill in the art to have reasonably inferred that 
Abraham's management table would contain passwords. Such a feature is implied by Abraham 
because he teaches that a user is monitored only after logging into the LAN. One of ordinary 
skill in the art would understand this to include submitting a user ID and a password as is well 
known in the art. Thus, passwords are stored with user IDs, as further evinced by Nickles. 

As to the second limitation, Bruins is directed to a system for collecting and using data 
related to message flows such as packet information [abstract]. Bruins discloses a rule for 
determining whether a total number of packets meeting a monitoring parameter (from a specific 
device and user) is over a predetermined number [column 1 «lines 26-3 6» | column 5 «lines 13- 
22»: billing users based on total number of packets]. This interpretation of Applicant's claim is 
consistent with Applicant's specification which describes a monitoring parameter as a device 
address and the rule relates to monitoring the total number of packets from that specific device. 

It would have been obvious to one of ordinary skill in the art to have modified Abraham's 
invention to include Bruins packet collection functionality. Bruins discloses the ability to collect 
specific packet information are useful to expand the number of ways of billing users (such as for 
total number of packets). Additionally, modifying Abraham's system to include such a feature is 
merely an example of using a known technique (Bruins' monitoring of the total number of 
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packets for a specific device) to improve similar devices (Abraham's packet monitoring and 
billing system) in the same way (able to bill users based on total number of packets). 

7. As to claim 6, Abraham discloses the packet monitor device including: 

a second memory which stores said monitoring parameter transmitted from said 
second device [column 7 «lines 22-50»]; 

a third memory which stores said threshold parameter transmitted from said second 
device [column 2 «lines 47-5 3 » | column 7 «lines 22-5 0»]; and 

a third device which said third and fourth memories when said second device transmits a 
request to said packet monitor device to start or finish monitoring said packet [column 6 «line 
60» to column 7 «line 3» | column 7 «lines 22-50» | column 47 «lines 5-24»]. 

8. As to claim 7, Abraham discloses the analyzer analyzing whether there is any rule in said 
interval and whether said interval exceeds said threshold parameter [column 1 1 «lines 53-64»], 
and said annunciator makes annunciation to said end-user when said analyzer judges that there is 
a certain rule in said interval and that said interval exceeds said threshold parameter [column 13 
«lines 53-60»]. 

9. As to claim 8, Abraham discloses a method of monitoring packets transmitted on a 
channel connecting an application server and an end-user of said application server to each other, 
comprising the steps of: 

acquiring a monitoring parameter indicative of a packet to be monitored, when said 
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end-user logs-in his|her terminal [column 5 «line 63» to column 6 «line 4»]; 

monitoring a time at which packets coincident with said monitoring parameter arrive, and 
determining whether there is any rule in an interval between a time when the monitoring 
parameter is acquired said arrival time [column 7 «lines 51-67» | column 1 1 «lines 53-64» | 
column 41 «line 53» to column 42 «line 42»]; 

making annunciation to said end-user when there is a certain rule in said interval [column 
13 «lines 61-67»]; and 

monitoring at least one of a data sequence of said packets, a service identifier of said 
packets [Figure 8 J | column 21 «lines 39-50» : protocol ID identifies the type of service - for 
example, email, web, or FTP], and a checksum of said packet; 

wherein said monitoring parameter is included in a user management table which further 
includes an ID number of said user and a threshold parameter designating a method of 
monitoring said packet [Figures 9D, 17, 25 A, 25B : notify rule, log rule | column 15 «lines 35- 
40»], and said step includes the steps of: 

retrieving said user management table, based on said ID number input by said end- 
user [column 8 «lines 13-25» | column 16 «lines 12-19» : user must log in to the LAN before 
monitoring begins - process of logging in submits his user ID]; 

acquiring said monitoring parameter, if said monitoring parameter is stored in said 
user management table [Figure 17 : user rules]; and 

acquiring said threshold parameter, if said threshold parameter is stored in said user 
management table [Figures 17, 25B : user policies such as quota limit | column 34 «lines 11- 
58»], and 
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and 

wherein said threshold parameter is a predetermined number [Fig. 25b «item 1 77»] . 

Abraham does not expressly disclose (1) storing a password in the table or (2) wherein 
said rule is that whether a total number of continuously receiving packets meeting said 
monitoring parameter in said interval is over said predetermined number. However both features 
were well known in the art at the time of Applicant's invention as evidenced by Nickles and 
Bruins. See the rejection of claim 3. 

10. As to claim 9, Abraham discloses ceasing monitoring when said end-user logs-out his|her 
terminal [column 8 «lines 23-25»]. 

11. As to claim 1 1 , Abraham discloses the step including the step of analyzing whether there 
is a certain rule in said interval and whether said interval exceeds said threshold parameter, after 
acquiring said threshold parameter and said step includes the step of making annunciation to said 
end-user, if there is a certain rule in said interval and said interval exceeds said threshold 
parameter [column 11 «lines 53-64» | column 13 «lines 53-60»]. 

12. As to claims 14, 17, and 18, as they are merely mediums that store the system of claims 
3, 6, and 7, respectively, they do not teach over the claimed limitations. Therefore claims 14, 17, 
and 18 are rejected for the same reasons set forth for claims 3, 6, and 7, supra. 
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13. As to claims 19 and 20, as they are merely mediums that store the system of claims 8 and 
9, respectively, they do not teach over the claimed limitations. Therefore claims 19 and 20 are 
rejected for the same reasons set forth for claims 8 and 9, supra. 

14. As to claims 22, as it is merely a medium that stores the system of claim 1, it does not 
teach over the claimed limitations. Therefore claim 22 is rejected for the same reasons set forth 
for claim 1 1 . 

15. As to claims 23 and 24, Abraham discloses the end-user is not performing an 
administrative function of said application server [column 5 «line 63» to column 6 «line 4» : 
difference between client computers and administrative computers | column 16 «lines 12-16»]. 

16. As to claim 25, Abraham discloses the packet monitor is located in the channel between 
the application server and the end-user [Figure 2 «item 50»]. 

17. As to claim 26, Abraham discloses said packet monitor device is configured to compare 
information about said packets to said monitoring parameter [column 45 «lines 1-3 1» : 
determining whether the intercepted packets match any of the user-defined rules. Matching 
packets imply that the information about said packets is compared to the rules]. 

18. As to claim 27, Abraham discloses a counter, wherein said counter is configured such 
that, if said rule is satisfied, then said counter is incremented [column 14 «lines 32-40» | column 
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46 «lines 1 1-24» | column 48 «lines 41-54» where : Abraham's log reads on Applicant's claimed 
counter. Every time a rule matches a rule, the log is updated to indicate the match. In this way, 
the log provides a count of the packets that matched the monitoring rule]. 

19. As to claim 28, Abraham discloses a comparator, which compares said counter to said 
threshold parameter [column 49 «lines l-22» where : the count in the log table is compared with 
a quota threshold]. 

20. As to claim 29, Abraham discloses said threshold parameter comprises a duration after 
which a packet coincides with the monitoring parameter [column 40 «lines 20-34» : 
predetermined time interval] or a service fee. 

21 . Claim 30 is rejected under 35 U.S.C. § 103(a) as being unpatentable over Abraham and 
Nickles, in view of Applicant's admitted prior art ["admitted art"]. 

22. As to claim 30, while Abraham does disclose services such as email and the Internet 
[Figure 8L], Abraham does not expressly disclose that such services are provided for a fee. 
However, providing services such as email or internet access for a fee was a well known feature 
in the art at the time of Applicant's invention. For example, Applicant's admitted art discloses 
that service providers typically employ service fees for using email or the Internet. Therefore it 
would have been reasonable for one of ordinary skill in the art to have inferred that Abraham's 
services were provided for a fee as taught by Applicant's admitted art. It would have been 
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obvious for one of ordinary skill in the art because service fees are valuable way for service 
providers to make a profit. 



Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to DOHM CHANKONG whose telephone number is (571)272- 
3942. The examiner can normally be reached on Monday-Friday [8:30 AM to 4:30 PM]. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John Follansbee can be reached on 57 1 .272.3964. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Dohm Chankong/ 

Primary Examiner, Art Unit 2452 



